Veeam

Overview

Veeam is a data protection and disaster recovery solution designed for modern IT environments. It provides backup, replication, and recovery capabilities for virtual, physical, cloud, and SaaS workloads.

Veeam extension scope

The Veeam extension for EventLog Analyzer is designed to enable seamless integration of log data from Veeam Backup & Replication or Veeam ONE into the EventLog Analyzer ecosystem. This extension provides features such as log collection, parsing, reporting, alerting, correlation, and advanced log search capabilities.

Audited Veeam events

Authentication and authorization

• MFA management
• Password and credential management
• Four-eyes authorization events

Identity management

• User and group management

Malware detection

• Malware detection configuration changes
• Malware detection session completion events
• Malware activity detection events
• Malware remediation actions

Configuration management

• Global network traffic rule changes
• Global VM exclusion changes
• General settings changes
• Host configurations

Jobs

• Job sessions history
• Job configurations
• Restore sessions history

Infrastructure management

• Failover plan management
• Failover plan execution history
• Infrastructure location changes

Licensing

• License updates

How to configure Veeam log source

1. After installing the Veeam extension, configure the log sources by navigating to Settings > Applications > Other Applications.
2. Select Veeam from the Log Source Type dropdown.
3. Click the + icon to add a new device.

4. Choose a pre-configured host where Veeam Backup & Replication Server or Veeam ONE Server is installed. If the host is not pre-configured, click Configure Manually and enter the hostname or IP.

5. Click Add to save the configuration.

Enabling event forwarding

After configuring the log source, enable event forwarding in either Veeam ONE or Veeam Backup & Replication to send events to EventLog Analyzer. This requires a Veeam Data Platform Advanced or Premium license that supports syslog event forwarding.

Event forwarding in Veeam ONE

1. Open Veeam ONE Client and navigate to Server Settings > Syslog.
2. Check Enable Syslog.
3. In Syslog server, enter the Hostname or IP of the EventLog Analyzer server in the log source.
4. Select mail under the Syslog facility dropdown.
5. Choose UDP or TCP under the Syslog transport dropdown.
6. Enter a port in which the EventLog Analyzer server is listening for Syslogs.
7. Check all options under Syslog audit events to enable comprehensive search and reporting in EventLog Analyzer.
8. Click OK to save the configuration.

For detailed steps, refer to the official guide on Syslog integration in Veeam ONE.

Event forwarding in Veeam Backup & Replication

1. Open Veeam Backup & Replication Console and go to Options > Event Forwarding.
2. Click Add under Syslog servers to configure a Syslog server.
3. In the Server field, provide the Hostname or IP of the EventLog Analyzer server.
4. Enter a port in which the EventLog Analyzer server is listening for Syslogs.
5. Select UDP or TCP under the Transport dropdown.
6. Click OK to add the syslog server, then click Apply to save changes.

For more details, refer to the official guide on Syslog integration in Veeam Backup & Replication.

Enabling correlation profiles

1. Go to Settings > Marketplace > Installed Extensions. Click Manage under Configuration to open the Manage Configuration page.

2. Click Redirect next to Correlation Rules to open the Correlation tab. Select Veeam from the Rule Category selector to view the available correlation rules.

3. Review the available correlation rules and enable the required ones.

Enabling alert profiles

1. After configuring the log source, navigate to Settings > Marketplace > Installed Extensions. Click Manage under configuration to open the Manage Configuration page.

2. Click Redirect next to Alert Profiles to navigate to the Alerts tab. Extension alert profiles appear under Custom Alert Profiles. Use the Created By column to identify Veeam alert profiles.

3. Browse the available alert profiles and enable the required ones.

Viewing Veeam reports

To view Veeam reports, navigate to the Reports tab and select Veeam under custom reports.

Veeam events

Below is a list of Veeam events that EventLog Analyzer can track, helping you monitor backup and recovery activities effectively.

Related resources

1. How to install an extension